GCP VM Instance with secrets in Metadata

Description

Instance metadata can be used to access user data that was specified when launching the instance. For example, a parameter can be specified for configuring the instance or include a simple script. The metadata is not protected by authentication or cryptography; therefore, anyone with access to the instance can view it. Secrets were found for the instance {GcpVmInstance} in the Metadata. A malicious actor may use the secrets to compromise additional assets in the account.